Cloud-based services (e.g., customer relationship management (CRM) services, software as a service (SaaS) providers, etc.) typically have used authorization and/or authentication flows (e.g., OAuth flow, Security Assertion Markup Language (SAML) flow, Basic Authentication flow, and/or any other type of authorization and/or authentication flow) to authenticate the user of a device prior to providing access to the service. In the typical prior approach, the authorization determination was made based solely on user information. Information about the (e.g., mobile) device being used by the user (e.g., device identity, security state, location, etc.) typically has not been available to such services to be used in determining whether to provide access to the service.